Win32:Alureon-DR [Rtk] tdlwsp.dll

Status
Niet open voor verdere reacties.
J

jaseur10

Gebruiker
Lid geworden
18 nov 2008
Berichten
18
Avast detecteerd iedere 20 minuten: c: windows/system32/tdlwsp.dll (Win32:Alureon-DR [Rtk]). Wanneer ik het bestand verwijder, komt het vanzelf steeds weer terug.
Diverse spyware progs/virusscanners geprobeerd en windows defender, niets kan het virus voorgoed laten verdwijnen!
Ik draai op XP.
Wie weet hier raad mee.
 
Download MBAM (Malwarebytes' Anti-Malware) hier.
o Dubbelklik op mbam-setup.exe om het programma te installeren.
o Zorg ervoor dat er een vinkje geplaatst is voor Update Malwarebytes' Anti-Malware en Start Malwarebytes' Anti-Malware, Klik daarna op "Voltooien".
o Indien een update gevonden werd, zal die gedownload en geïnstalleerd worden.
o Wanneer het programma volledig up to date is, selecteer dan in het tabblad Scanner : "Volledige Scan", daarna klik op Scan.
o Het scannen kan een tijdje duren, dus wees geduldig.
o Wanneer de scan voltooid is, klik op OK, daarna "Bekijk Resultaten" om de resultaten te zien.
o Zorg ervoor dat daar alles aangevinkt is, daarna klik op: Verwijder geselecteerde.
o Na het verwijderen zal een log openen en zal er gevraagd worden om de computer opnieuw op te starten. (Zie verder)

De log wordt automatisch bewaard door MBAM en kan je terugvinden door op de "Logs" tab te klikken in MBAM.
Kopieer en plak de inhoud van het logje in je volgend antwoord.
Indien MBAM moeilijkheden heeft met het verwijderen van bepaalde bestanden zal het enkele meldingen geven waar je OK moet klikken.
Daarna zal het vragen om de Computer opnieuw op te starten... dus sta toe dat MBAM de computer opnieuw opstart.
 
Malwarebytes' Anti-Malware 1.41
Database versie: 3126
Windows 5.1.2600 Service Pack 3

8-11-2009 19:39:43
mbam-log-2009-11-08 (19-39-43).txt

Scan type: Volledige Scan (C:\|)
Objecten gescand: 150137
Verstreken tijd: 1 hour(s), 0 minute(s), 58 second(s)

Geheugenprocessen geïnfecteerd: 0
Geheugenmodulen geïnfecteerd: 0
Registersleutels geïnfecteerd: 0
Registerwaarden geïnfecteerd: 1
Registerdata bestanden geïnfecteerd: 0
Mappen geïnfecteerd: 0
Bestanden geïnfecteerd: 17

Geheugenprocessen geïnfecteerd:
(Geen kwaadaardige items gevonden)

Geheugenmodulen geïnfecteerd:
(Geen kwaadaardige items gevonden)

Registersleutels geïnfecteerd:
(Geen kwaadaardige items gevonden)

Registerwaarden geïnfecteerd:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{110b50f0-4954-4300-b71d-d4de33922b3a} (Rogue.SpywareCleaner2009) -> Quarantined and deleted successfully.

Registerdata bestanden geïnfecteerd:
(Geen kwaadaardige items gevonden)

Mappen geïnfecteerd:
(Geen kwaadaardige items gevonden)

Bestanden geïnfecteerd:
C:\Documents and Settings\Ton Warnaar\Local Settings\Temp\svchost.scr (Trojan.Generic) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ton Warnaar\Local Settings\Temporary Internet Files\Content.IE5\8107A1I5\A-Installd2f1c4_2009-1[1].exe (Rogue.Installer) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ton Warnaar\Local Settings\Temporary Internet Files\Content.IE5\BAF3WV5I\A-Installbc87e_2009-1[1].exe (Rogue.Installer) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ton Warnaar\Local Settings\Temporary Internet Files\Content.IE5\I5IBBF55\A-Installa5320fa_2009-1[1].exe (Rogue.Installer) -> Quarantined and deleted successfully.
C:\RECYCLER\S-1-5-21-602162358-1715567821-1177238915-1003\Dc95.scr (Trojan.Generic) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{5DE93F41-BCEE-4AE7-8D71-3B199A00F458}\RP76\A0011910.exe (Rogue.SpywareCleaner2009) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{5DE93F41-BCEE-4AE7-8D71-3B199A00F458}\RP76\A0011911.exe (Rogue.SpywareCleaner2009) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{5DE93F41-BCEE-4AE7-8D71-3B199A00F458}\RP76\A0011913.exe (Rogue.SpywareCleaner2009) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{5DE93F41-BCEE-4AE7-8D71-3B199A00F458}\RP76\A0011914.exe (Rogue.SpywareCleaner2009) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{5DE93F41-BCEE-4AE7-8D71-3B199A00F458}\RP76\A0011915.exe (Rogue.SpywareCleaner2009) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{5DE93F41-BCEE-4AE7-8D71-3B199A00F458}\RP76\A0011922.exe (Rogue.SpywareCleaner2009) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{5DE93F41-BCEE-4AE7-8D71-3B199A00F458}\RP76\A0011923.exe (Rogue.SpywareCleaner2009) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{5DE93F41-BCEE-4AE7-8D71-3B199A00F458}\RP76\A0011925.exe (Rogue.SpywareCleaner2009) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{5DE93F41-BCEE-4AE7-8D71-3B199A00F458}\RP76\A0011926.exe (Rogue.SpywareCleaner2009) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{5DE93F41-BCEE-4AE7-8D71-3B199A00F458}\RP76\A0011928.dll (Rogue.SpywareCleaner2009) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{5DE93F41-BCEE-4AE7-8D71-3B199A00F458}\RP76\A0011930.exe (Rogue.SpywareCleaner2009) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{5DE93F41-BCEE-4AE7-8D71-3B199A00F458}\RP76\A0011931.exe (Rogue.SpywareCleaner2009) -> Quarantined and deleted successfully.
 
Complete scanning result of "tdlwsp.dll", processed in VirusTotal at 11/09/2009 16:55:00 (CET).

[ file data ]
* name..: tdlwsp.dll
* size..: 22016
* md5...: 053f78371f8d6c26a89a696e435a83dd
* sha1..: 515029d75a3fa6bc3bfdef7b5cdb1770807fb15f
* peid..: -

[ scan result ]
a-squared 4.5.0.41/20091109 found [Packed.Win32.Tdss!IK]
AhnLab-V3 5.0.0.2/20091106 found nothing
AntiVir 7.9.1.61/20091109 found [TR/Vundo.Gen]
Antiy-AVL 2.0.3.7/20091109 found [Packed/Win32.Tdss.gen]
Authentium 5.2.0.5/20091109 found nothing
Avast 4.8.1351.0/20091109 found [Win32:Alureon-DR]
AVG 8.5.0.423/20091109 found [Agent_r.OT]
BitDefender 7.2/20091109 found [Gen:Trojan.Heur.TDSS.bu4@k0GBf8fi]
CAT-QuickHeal 10.00/20091109 found [Win32.Packed.TDSS.z.5]
ClamAV 0.94.1/20091109 found nothing
Comodo 2897/20091109 found [TrojWare.Win32.TDSS.z]
DrWeb 5.0.0.12182/20091109 found [BackDoor.Tdss.based.1]
eTrust-Vet 35.1.7111/20091109 found [Win32/Tidserv.S]
F-Prot 4.5.1.85/20091109 found nothing
F-Secure 9.0.15370.0/20091109 found [Gen:Trojan.Heur.TDSS.bu4@k0GBf8fi]
Fortinet 3.120.0.0/20091109 found [W32/Tdss.Z]
GData 19/20091109 found [Gen:Trojan.Heur.TDSS.bu4@k0GBf8fi]
Ikarus T3.1.1.74.0/20091109 found [Packed.Win32.Tdss]
Jiangmin 11.0.800/20091109 found nothing
K7AntiVirus 7.10.891/20091107 found [Trojan.Win32.Malware.1]
Kaspersky 7.0.0.125/20091109 found [Packed.Win32.TDSS.z]
McAfee 5796/20091108 found nothing
McAfee+Artemis 5796/20091108 found [Artemis!053F78371F8D]
McAfee-GW-Edition 6.8.5/20091109 found [Trojan.Vundo.Gen]
Microsoft 1.5202/20091109 found [Trojan:Win32/Alureon.gen!U]
NOD32 4588/20091109 found nothing
Norman 6.03.02/20091109 found [W32/TDSS.ADR]
nProtect 2009.1.8.0/20091109 found [Trojan/W32.TDSS.22016.AF]
Panda 10.0.2.2/20091108 found [Trj/CI.A]
PCTools 7.0.3.5/20091109 found [Backdoor.Tidserv]
Prevx 3.0/20091109 found [Medium Risk Malware]
Rising 22.21.00.08/20091109 found nothing
Sophos 4.47.0/20091109 found [Mal/Generic-A]
Sunbelt 3.2.1858.2/20091108 found [Trojan.Win32.Generic!BT]
Symantec 1.4.4.12/20091109 found [Backdoor.Tidserv]
TheHacker 6.5.0.2.063/20091106 found nothing
TrendMicro 9.0.0.1003/20091109 found [TROJ_ALUREON.AXD]
VBA32 3.12.10.11/20091109 found nothing
ViRobot 2009.11.9.2027/20091109 found [Trojan.Win32.Tdss.22016.Z]
VirusBuster 4.6.5.0/20091108 found nothing

[ notes ]
http://info.prevx.com/aboutprogramtext.asp?PX5=56E722790092C35E5639004ADEE07000CE688441
 
Download en installeer a-squared Free.
  • Na de installatie start je a-squared Free.
  • a-squared Free zal nu even vragen om up te daten, klik hier op Ja.
  • Indien a-squared Free opnieuw moet opstarten om de update te voltooien laat je dit doen. Start a-squared Free daarna weer op en controleer of je alle updates hebt.
  • Klik daarna op Nu scannen in het startscherm.
  • Kies in het volgende scherm voor een Diepe scan.
  • Als de scan voltooid is klik je op Rapport opslaan. Sla dit op je bureaublad op en post het in je volgend bericht
. :thumb:
 
a-squared Free - Versie 4.5
Laatste Update: 9-11-2009 20:00:57

Scan instellingen:

Scan type: Diepe Scan
Objecten: Geheugen, Sporen, Cookies, C:\, D:\
Scan archieven: Aan
Heuristieken: Uit
ADS Scan: Aan

Scan starten: 9-11-2009 20:01:48

c:\program files\intelore\rar password recovery Ontdekt: Trace.Directory.RAR Password Recovery!A2
c:\program files\intelore Ontdekt: Trace.Directory.Intelore RAR Password Recovery v1.1!A2
c:\program files\intelore\rar password recovery\default.urp Ontdekt: Trace.File.RAR Password Recovery!A2
C:\Documents and Settings\Ton Warnaar\Cookies\ton_warnaar@com[1].txt Ontdekt: Trace.TrackingCookie.com!A2
C:\Documents and Settings\Ton Warnaar\Cookies\ton_warnaar@doubleclick[1].txt Ontdekt: Trace.TrackingCookie.doubleclick!A2
C:\Documents and Settings\Ton Warnaar\Cookies\ton_warnaar@tradedoubler[1].txt Ontdekt: Trace.TrackingCookie.tradedoubler!A2
C:\Documents and Settings\Ton Warnaar\Local Settings\Temporary Internet Files\Content.IE5\D8F6DKV8\sdpatch[1].exe Ontdekt: AdWare.Spatch.A!IK
C:\Documents and Settings\Ton Warnaar\Local Settings\Temporary Internet Files\Content.IE5\I5IBBF55\1[1].htm Ontdekt: Virus.JS.FakeAV!IK
C:\Documents and Settings\Ton Warnaar\Local Settings\Temporary Internet Files\Content.IE5\I5IBBF55\PCTools.Registry.Mechanic.v8.0.0.900.Incl.Keymaker[1].rar/keygen.exe Ontdekt: Riskware.Keygen.RegistryMech!IK
C:\Documents and Settings\Ton Warnaar\Local Settings\Temporary Internet Files\Content.IE5\Z0I2WX1M\1[1].htm Ontdekt: Virus.JS.FakeAV!IK
C:\Documents and Settings\Ton Warnaar\Mijn documenten\LimeWire\Saved\Driver_Detective.V6.2.5.0\Driver Detective 6.2.5.0\DriverDetective.exe/EULA.exe Ontdekt: Trojan.Win32.Alureon!IK
C:\Program Files\Spyware Doctor\sdpatch.exe Ontdekt: AdWare.Spatch.A!IK
C:\System Volume Information\_restore{5DE93F41-BCEE-4AE7-8D71-3B199A00F458}\RP76\A0010895.dll Ontdekt: Packed.Win32.Tdss!IK
C:\System Volume Information\_restore{5DE93F41-BCEE-4AE7-8D71-3B199A00F458}\RP76\A0011890.dll Ontdekt: Packed.Win32.Tdss!IK
C:\System Volume Information\_restore{5DE93F41-BCEE-4AE7-8D71-3B199A00F458}\RP76\A0012102.dll Ontdekt: Packed.Win32.Tdss!IK
C:\System Volume Information\_restore{5DE93F41-BCEE-4AE7-8D71-3B199A00F458}\RP77\A0012125.dll Ontdekt: Packed.Win32.Tdss!IK
C:\System Volume Information\_restore{5DE93F41-BCEE-4AE7-8D71-3B199A00F458}\RP77\A0012248.dll Ontdekt: Packed.Win32.Tdss!IK
C:\System Volume Information\_restore{5DE93F41-BCEE-4AE7-8D71-3B199A00F458}\RP79\A0012489.dll Ontdekt: Packed.Win32.Tdss!IK
C:\System Volume Information\_restore{5DE93F41-BCEE-4AE7-8D71-3B199A00F458}\RP82\A0012982.dll Ontdekt: Packed.Win32.Tdss!IK
C:\System Volume Information\_restore{5DE93F41-BCEE-4AE7-8D71-3B199A00F458}\RP86\A0013677.dll Ontdekt: Packed.Win32.Tdss!IK
C:\System Volume Information\_restore{5DE93F41-BCEE-4AE7-8D71-3B199A00F458}\RP86\A0013719.dll Ontdekt: Packed.Win32.Tdss!IK
C:\System Volume Information\_restore{5DE93F41-BCEE-4AE7-8D71-3B199A00F458}\RP86\A0014695.dll Ontdekt: Packed.Win32.Tdss!IK
C:\System Volume Information\_restore{5DE93F41-BCEE-4AE7-8D71-3B199A00F458}\RP86\A0014727.dll Ontdekt: Packed.Win32.Tdss!IK
C:\System Volume Information\_restore{5DE93F41-BCEE-4AE7-8D71-3B199A00F458}\RP86\A0014744.dll Ontdekt: Packed.Win32.Tdss!IK
C:\System Volume Information\_restore{5DE93F41-BCEE-4AE7-8D71-3B199A00F458}\RP86\A0014784.dll Ontdekt: Packed.Win32.Tdss!IK
C:\System Volume Information\_restore{5DE93F41-BCEE-4AE7-8D71-3B199A00F458}\RP87\A0014826.dll Ontdekt: Packed.Win32.Tdss!IK
C:\System Volume Information\_restore{5DE93F41-BCEE-4AE7-8D71-3B199A00F458}\RP87\A0014831.dll Ontdekt: Packed.Win32.Tdss!IK
C:\System Volume Information\_restore{5DE93F41-BCEE-4AE7-8D71-3B199A00F458}\RP89\A0014870.dll Ontdekt: Packed.Win32.Tdss!IK
C:\System Volume Information\_restore{5DE93F41-BCEE-4AE7-8D71-3B199A00F458}\RP89\A0014923.dll Ontdekt: Packed.Win32.Tdss!IK
C:\System Volume Information\_restore{5DE93F41-BCEE-4AE7-8D71-3B199A00F458}\RP89\A0015922.dll Ontdekt: Packed.Win32.Tdss!IK
C:\System Volume Information\_restore{5DE93F41-BCEE-4AE7-8D71-3B199A00F458}\RP90\A0015934.dll Ontdekt: Packed.Win32.Tdss!IK
C:\System Volume Information\_restore{5DE93F41-BCEE-4AE7-8D71-3B199A00F458}\RP90\A0016127.dll Ontdekt: Packed.Win32.Tdss!IK
C:\System Volume Information\_restore{5DE93F41-BCEE-4AE7-8D71-3B199A00F458}\RP91\A0016169.dll Ontdekt: Packed.Win32.Tdss!IK
C:\System Volume Information\_restore{5DE93F41-BCEE-4AE7-8D71-3B199A00F458}\RP91\A0016355.dll Ontdekt: Packed.Win32.Tdss!IK
C:\System Volume Information\_restore{5DE93F41-BCEE-4AE7-8D71-3B199A00F458}\RP91\A0016383.dll Ontdekt: Packed.Win32.Tdss!IK
C:\System Volume Information\_restore{5DE93F41-BCEE-4AE7-8D71-3B199A00F458}\RP91\A0016416.dll Ontdekt: Packed.Win32.Tdss!IK
C:\WINDOWS\system32\tdlwsp.dll Ontdekt: Packed.Win32.Tdss!IK
D:\Films\keygen.exe Ontdekt: Riskware.Keygen.RegistryMech!IK
D:\Films\registry mechanic[1]\Registry Mechanic v7.0.0.10+keygen workin perfect .exe Ontdekt: Trojan-Downloader.Ftp.who!IK
D:\Films\registry mechanic[1]\Registry Mechanic v7.0.0.10+keygen workin perfect .rar/Registry Mechanic v7.0.0.10+keygen workin perfect .exe Ontdekt: Trojan-Downloader.Ftp.who!IK
D:\Spyware.Doctor.v5.5.0.204.www.cw-network.info\sdpatch.exe Ontdekt: AdWare.Spatch.A!IK
D:\System Volume Information\_restore{5DE93F41-BCEE-4AE7-8D71-3B199A00F458}\RP91\A0016434.exe Ontdekt: Trojan-Downloader.Ftp.who!IK
D:\Windows valideren\keyfinder.exe/findkey.exe Ontdekt: Riskware.HackTool.Findkey!IK
D:\Windows valideren\keyfinder.exe/xpkey.exe Ontdekt: Riskware.PSWTool.Win32.RAS!IK
D:\Windows valideren\keyfinder.exe/officekey.exe Ontdekt: Riskware.Hacktool.OfficeKey!IK

Gescand

Bestanden: 120232
Sporen: 637750
Cookies: 1134
Processen: 45

Gevonden

Bestanden: 39
Sporen: 3
Cookies: 3
Processen: 0
Registersleutels: 0

Scan einde: 9-11-2009 21:00:18
Scan tijd: 0:58:30
 
Bedoel je of de melding van het bestand tdlwsp.dll uit zichzelf weer terugkomt?
Als het terugkomt is het meestal na een half uurtje ofzo
 
Download Combofix naar je Bureaublad.

Lees hier meer over correct gebruik van Combofix.

OPMERKING: indien je, tijdens of na het downloaden van Combofix of tijdens het gebruik van Combofix een melding krijgt van je Antivirus- of een andere realtime scanner, schakel dan deze scanner uit en download Combofix opnieuw.
Sommige scanners zien bepaalde componenten die Combofix gebruikt als verdacht en gaan deze blokkeren of verwijderen!:rolleyes:
Dubbelklik op Combofix.exe om het te starten.
Indien je Combofix al eerder hebt gebruikt, kan je een waarschuwing krijgen dat een update beschikbaar is. Sta toe dat ComboFix wordt geupdate.
Volg de instructies, aanvaard de disclaimer door op Ja te klikken.
Indien de Recovery Console niet geïnstalleerd is, wordt je gevraagd om dit alsnog te doen door op JA te klikken in het "Query - Recovery Console" venster (enkel voor XP, niet voor VISTA).
Klik op OK en Ja om automatisch de Recovery Console te laten installeren.
Klik na afloop terug op Ja om het scannen op malware te starten.
Tijdens het runnen van de fix, NIET in het venster klikken, want dit zal je pc doen vasthangen.
Wanneer de fix voltooid is en na herstart, zal de log Combofix.txt openen.

Post dit logje in je volgende antwoord.
 
ComboFix 09-11-09.01 - Ton Warnaar 10-11-2009 16:40.1.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.31.1043.18.767.323 [GMT 1:00]
Gestart vanuit: c:\documents and settings\Ton Warnaar\Bureaublad\ComboFix.exe
AV: avast! antivirus 4.8.1356 [VPS 091110-0] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
.

(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\Desktop_.ini

Besmet exemplaar van c:\windows\system32\drivers\atapi.sys werd aangetroffen en gedesinfecteerd
Hersteld exemplaar van - Kitty ate it :p
.
(((((((((((((((((((( Bestanden Gemaakt van 2009-10-10 to 2009-11-10 ))))))))))))))))))))))))))))))
.

2009-11-10 15:17 . 2009-11-10 15:17 -------- d-----w- c:\windows\Performance
2009-11-10 15:16 . 2009-11-10 15:16 -------- d-----w- c:\documents and settings\Ton Warnaar\Local Settings\Application Data\Microsoft Corporation
2009-11-10 15:16 . 2009-11-10 15:16 -------- d-----w- c:\program files\Microsoft Windows 7 Upgrade Advisor
2009-11-10 15:15 . 2009-11-10 15:15 22016 ----a-w- c:\windows\system32\tdlwsp.dll
2009-11-09 18:58 . 2009-11-09 20:47 -------- d-----w- c:\program files\a-squared Free
2009-11-05 20:24 . 2009-11-05 20:24 -------- d-----w- c:\documents and settings\Ton Warnaar\Local Settings\Application Data\PCHealth
2009-11-05 19:22 . 2008-02-01 11:55 42376 ----a-w- c:\windows\system32\drivers\ikfilesec.sys
2009-11-05 19:22 . 2007-12-10 13:53 29576 ----a-w- c:\windows\system32\drivers\kcom.sys
2009-11-05 19:22 . 2007-12-10 13:53 81288 ----a-w- c:\windows\system32\drivers\iksyssec.sys
2009-11-05 19:22 . 2007-12-10 13:53 66952 ----a-w- c:\windows\system32\drivers\iksysflt.sys
2009-11-05 19:21 . 2009-11-09 20:04 -------- d-----w- c:\program files\Spyware Doctor
2009-11-05 19:21 . 2009-11-05 19:21 -------- d-----w- c:\documents and settings\Ton Warnaar\Application Data\PC Tools
2009-11-05 15:50 . 2009-09-15 11:54 52368 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2009-11-05 15:50 . 2009-09-15 11:54 23152 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2009-11-05 15:50 . 2009-09-15 11:53 27408 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2009-11-05 15:50 . 2009-09-15 11:56 93424 ----a-w- c:\windows\system32\drivers\aswmon.sys
2009-11-05 15:50 . 2009-09-15 11:56 94160 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2009-11-05 15:50 . 2009-09-15 11:55 114768 ----a-w- c:\windows\system32\drivers\aswSP.sys
2009-11-05 15:50 . 2009-09-15 11:55 20560 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2009-11-05 15:50 . 2009-09-15 11:53 97480 ----a-w- c:\windows\system32\AvastSS.scr
2009-11-05 15:50 . 2009-09-15 11:59 1279968 ----a-w- c:\windows\system32\aswBoot.exe
2009-11-04 15:10 . 2009-11-04 15:10 -------- d--h--w- c:\windows\PIF
2009-11-04 14:55 . 2009-11-04 14:55 -------- d-----w- c:\windows\system32\WinDefense32
2009-11-04 10:18 . 2009-11-05 17:23 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-11-04 10:18 . 2009-11-05 17:21 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-11-03 15:33 . 2009-11-03 15:33 -------- d-----w- c:\documents and settings\All Users\Application Data\Office Genuine Advantage
2009-11-03 15:01 . 2009-11-03 15:41 -------- d-----w- C:\Spyware Cleaner 2009
2009-11-03 14:54 . 2009-11-03 14:54 -------- d-----w- c:\windows\Sun
2009-11-03 14:14 . 2009-08-27 09:31 16384 ----a-w- c:\windows\system32\drivers\DiagnosticScan.SYS
2009-11-03 14:14 . 2009-10-19 10:21 5120 ----a-w- c:\windows\system32\drivers\Start1Driver.SYS
2009-11-03 14:14 . 2009-11-03 15:00 -------- d-----w- c:\program files\AA
2009-11-03 12:46 . 2009-11-03 12:46 -------- d-----w- c:\documents and settings\Ton Warnaar\Local Settings\Application Data\Threat Expert
2009-11-03 12:35 . 2009-11-10 15:39 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-11-03 12:28 . 2009-10-01 08:29 195440 ------w- c:\windows\system32\MpSigStub.exe
2009-11-02 23:48 . 2009-11-02 23:48 -------- d-----w- c:\program files\Zeallsoft
2009-10-17 18:10 . 2009-10-17 18:10 -------- d-----r- c:\documents and settings\Ton Warnaar\Application Data\Brother
2009-10-16 13:24 . 2009-10-16 13:24 -------- d-sh--w- c:\windows\system32\config\systemprofile\IETldCache
2009-10-15 16:53 . 2009-10-15 16:53 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache
2009-10-15 16:37 . 2009-10-15 16:37 34308 ----a-w- c:\documents and settings\All Users\Application Data\mazuki.dll
2009-10-15 16:06 . 2009-10-15 16:06 -------- d-----w- c:\program files\Gabest

.
((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-11-10 15:43 . 2003-04-08 12:00 594056 ----a-w- c:\windows\system32\perfh013.dat
2009-11-10 15:43 . 2003-04-08 12:00 110788 ----a-w- c:\windows\system32\perfc013.dat
2009-11-08 19:23 . 2009-11-08 19:23 -------- d-----w- c:\program files\Prevx
2009-11-08 19:23 . 2009-11-08 19:23 -------- d-----w- c:\program files\Common Files\Download Manager
2009-11-08 19:23 . 2009-11-08 16:47 -------- d-----w- c:\program files\Java
2009-11-08 19:23 . 2009-11-08 16:28 -------- d-----w- c:\documents and settings\All Users\Application Data\PrevxCSI
2009-11-08 19:22 . 2009-11-08 17:35 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-11-08 18:00 . 2009-09-08 12:28 -------- d-----w- c:\documents and settings\Ton Warnaar\Application Data\LimeWire
2009-11-08 17:35 . 2009-11-08 17:35 -------- d-----w- c:\documents and settings\Ton Warnaar\Application Data\Malwarebytes
2009-11-08 17:35 . 2009-11-08 17:35 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-11-08 16:47 . 2009-09-09 14:25 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-11-08 16:46 . 2009-11-08 16:46 152576 ----a-w- c:\documents and settings\Ton Warnaar\Application Data\Sun\Java\jre1.6.0_17\lzma.dll
2009-11-08 16:31 . 2009-09-07 18:37 -------- d-----w- c:\documents and settings\Ton Warnaar\Application Data\GrabIt
2009-11-05 17:20 . 2009-09-06 18:58 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-11-03 20:19 . 2009-09-07 19:54 -------- d-----w- c:\program files\Ashampoo
2009-10-22 11:10 . 2009-09-09 13:59 -------- d-----w- c:\program files\Common Files\Adobe
2009-10-19 11:20 . 2009-10-02 12:03 -------- d-----w- c:\documents and settings\Ton Warnaar\Application Data\Nero
2009-10-15 17:36 . 2009-10-02 11:46 -------- d-----w- c:\program files\Common Files\Nero
2009-10-15 17:29 . 2009-10-02 11:46 -------- d-----w- c:\documents and settings\All Users\Application Data\Nero
2009-10-15 13:11 . 2009-10-15 13:11 -------- d-----w- c:\program files\SubSync
2009-10-15 13:11 . 2009-10-12 10:41 249856 ------w- c:\windows\Setup1.exe
2009-10-15 13:11 . 2009-10-12 10:41 73216 ----a-w- c:\windows\ST6UNST.EXE
2009-10-12 10:41 . 2009-10-12 10:41 -------- d-----w- c:\program files\Brad Smith
2009-10-07 15:57 . 2009-10-07 15:45 57 ----a-w- c:\documents and settings\All Users\Application Data\Brother\BrLog\BrCollectDir\BR_cat.bat
2009-10-07 15:51 . 2009-10-07 15:51 50 ----a-w- c:\windows\system32\bridf05a.dat
2009-10-07 15:51 . 2009-10-07 15:51 -------- d-----w- c:\program files\Brother
2009-10-07 15:51 . 2009-09-06 19:15 -------- d-----w- c:\program files\Common Files\InstallShield
2009-10-07 15:46 . 2009-10-07 15:46 -------- d-----w- c:\documents and settings\All Users\Application Data\InstallShield
2009-10-07 15:46 . 2009-10-07 15:46 -------- d-----w- c:\program files\Common Files\ScanSoft Shared
2009-10-07 15:46 . 2009-10-07 15:46 -------- d-----w- c:\program files\ScanSoft
2009-10-07 15:46 . 2009-10-07 15:46 -------- d-----w- c:\documents and settings\All Users\Application Data\ScanSoft
2009-10-07 15:45 . 2009-10-07 15:45 -------- d-----w- c:\documents and settings\All Users\Application Data\Brother
2009-10-05 19:35 . 2009-10-05 12:50 -------- d-----w- c:\documents and settings\Ton Warnaar\Application Data\Skype
2009-10-05 19:32 . 2009-10-05 12:50 -------- d-----w- c:\documents and settings\Ton Warnaar\Application Data\skypePM
2009-10-05 13:34 . 2009-10-03 22:06 -------- d-----w- c:\program files\SWF-AVI-GIF Converter
2009-10-05 12:50 . 2009-10-05 12:50 56 ---ha-w- c:\windows\system32\ezsidmv.dat
2009-10-05 12:49 . 2009-10-05 12:49 -------- d-----r- c:\program files\Skype
2009-10-05 12:49 . 2009-10-05 12:49 -------- d-----w- c:\program files\Common Files\Skype
2009-10-05 12:49 . 2009-10-05 12:49 -------- d-----w- c:\documents and settings\All Users\Application Data\Skype
2009-10-03 22:09 . 2009-10-03 22:09 -------- d-----w- c:\program files\ImTOO
2009-10-02 11:57 . 2009-10-02 11:46 -------- d-----w- c:\program files\Nero
2009-10-02 11:49 . 2009-10-02 11:46 -------- d-----w- c:\program files\DVDlabPro2
2009-10-02 10:50 . 2009-10-02 10:50 -------- d-----w- c:\program files\DVD Decrypter
2009-10-02 08:55 . 2009-10-02 08:20 -------- d-----w- c:\documents and settings\Ton Warnaar\Application Data\ImgBurn
2009-10-02 08:06 . 2009-10-02 08:06 -------- d-----w- c:\program files\ImgBurn
2009-10-01 14:08 . 2009-10-01 14:08 -------- d-----w- c:\documents and settings\All Users\Application Data\Hagel Technologies
2009-10-01 14:08 . 2009-10-01 14:08 -------- d-----w- c:\program files\DU Meter
2009-09-28 16:12 . 2009-09-28 16:12 -------- d-----w- c:\program files\Notuleren
2009-09-25 16:58 . 2009-09-16 19:36 2289152 ----a-w- c:\windows\system32\TUKernel.exe
2009-09-25 16:17 . 2009-09-25 16:17 -------- d-----w- c:\program files\MSXML 4.0
2009-09-24 19:00 . 2009-09-24 19:00 -------- d-----w- c:\documents and settings\Ton Warnaar\Application Data\Samsung
2009-09-24 18:56 . 2009-09-24 18:40 5632 ----a-w- c:\windows\system32\drivers\StarOpen.sys
2009-09-24 18:39 . 2009-09-24 18:39 -------- d-----w- c:\program files\Samsung
2009-09-22 10:05 . 2009-09-22 10:05 -------- d-----w- c:\program files\Windows Media Connect 2
2009-09-19 09:46 . 2009-09-12 21:33 -------- d-----w- c:\program files\Kroll Ontrack
2009-09-17 11:51 . 2009-09-17 11:51 2373416 ----a-w- c:\documents and settings\All Users\Application Data\Nero\Nero 9\DrWeb\DrWeb32.dll
2009-09-17 11:47 . 2009-09-17 11:47 -------- d-----w- c:\program files\XviD
2009-09-17 11:42 . 2009-09-17 11:42 -------- d-----w- c:\program files\WinAVI Video Converter 9.0
2009-09-17 10:58 . 2009-09-17 10:58 2373416 ----a-w- c:\documents and settings\All Users\Application Data\Nero\Nero\DrWeb\DrWeb32.dll
2009-09-16 19:37 . 2009-09-16 19:37 5535744 ----a-w- c:\documents and settings\All Users\Application Data\TuneUp Software\TuneUp Utilities\WinStyler\tu_logonui.exe
2009-09-16 19:17 . 2009-09-16 19:17 604488 ----a-w- c:\windows\system32\TUProgSt.exe
2009-09-16 19:17 . 2009-09-16 19:17 361288 ----a-w- c:\windows\system32\TuneUpDefragService.exe
2009-09-16 19:17 . 2009-09-15 16:04 -------- d-----w- c:\program files\TuneUp Utilities 2009
2009-09-16 17:51 . 2009-09-16 17:49 -------- d-----w- c:\documents and settings\Ton Warnaar\Application Data\EditPlus 3
2009-09-15 16:43 . 2009-09-09 18:50 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help
2009-09-15 16:04 . 2009-09-15 16:04 -------- d-----w- c:\documents and settings\Ton Warnaar\Application Data\TuneUp Software
2009-09-15 16:04 . 2009-09-15 16:04 -------- d-----w- c:\documents and settings\All Users\Application Data\TuneUp Software
2009-09-15 16:04 . 2009-09-15 16:04 -------- d-sh--w- c:\documents and settings\All Users\Application Data\{55A29068-F2CE-456C-9148-C869879E2357}
2009-09-14 18:01 . 2009-09-14 18:01 -------- d-----w- c:\program files\Easy DVD Player
2009-09-14 15:52 . 2009-09-14 14:03 -------- d-----w- c:\documents and settings\Ton Warnaar\Application Data\VoipBuster
2009-09-14 10:31 . 2009-09-14 10:31 -------- d-----w- c:\program files\QuickPar
2009-09-12 20:57 . 2009-09-07 21:47 68456 ----a-w- c:\documents and settings\Ton Warnaar\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-09-12 10:32 . 2009-09-09 18:55 -------- d-----w- c:\program files\MSBuild
2009-09-12 10:32 . 2009-09-12 10:32 -------- d-----w- c:\program files\Reference Assemblies
2009-09-11 14:20 . 2008-04-14 20:32 136192 ----a-w- c:\windows\system32\msv1_0.dll
2009-09-10 13:54 . 2009-11-08 17:35 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-09-10 13:53 . 2009-11-08 17:35 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-09-09 19:27 . 2009-09-06 18:48 86327 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-09-09 14:25 . 2009-09-07 19:56 664 ----a-w- c:\windows\system32\d3d9caps.dat
2009-09-06 19:15 . 2009-09-06 19:15 315392 ----a-w- c:\windows\HideWin.exe
2009-09-06 19:15 . 2009-09-06 19:16 86016 ----a-w- c:\windows\SoundMan.exe
2009-09-06 19:15 . 2009-09-06 19:16 1826816 ----a-w- c:\windows\SkyTel.exe
2009-09-06 19:15 . 2009-09-06 19:16 1191936 ----a-w- c:\windows\RtlUpd.exe
2009-09-06 19:15 . 2009-09-06 19:16 9715200 ----a-w- c:\windows\RTLCPL.exe
2009-09-06 19:15 . 2009-09-06 19:16 4419584 ----a-w- c:\windows\system32\drivers\RtkHDAud.sys
2009-09-06 19:15 . 2009-09-06 19:16 16342528 ----a-w- c:\windows\RTHDCPL.exe
2009-09-06 19:15 . 2009-09-06 19:16 2162688 ----a-w- c:\windows\MicCal.exe
2009-09-06 19:15 . 2009-09-06 19:16 49152 ----a-w- c:\windows\system32\ChCfg.exe
2009-09-06 19:15 . 2009-09-06 19:16 69632 ----a-w- c:\windows\Alcmtr.exe
2009-09-06 19:15 . 2009-09-06 19:16 2808832 ----a-w- c:\windows\alcwzrd.exe
2009-09-06 19:15 . 2009-09-06 19:15 520192 ----a-w- c:\windows\RtlExUpd.dll
2009-09-06 18:44 . 2009-09-06 18:44 21748 ----a-w- c:\windows\system32\emptyregdb.dat
2009-09-04 21:05 . 2008-04-14 20:32 58880 ----a-w- c:\windows\system32\msasn1.dll
2009-08-29 08:00 . 2008-04-14 20:32 916480 ----a-w- c:\windows\system32\wininet.dll
2009-08-26 08:02 . 2008-04-14 20:32 247326 ----a-w- c:\windows\system32\strmdll.dll
.

((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DU Meter"="c:\program files\DU Meter\DUMeter.exe" [2009-03-13 1058816]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-07-23 8433664]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-07-23 81920]
"SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2003-10-14 155648]
"PaperPort PTD"="c:\program files\ScanSoft\PaperPort\pptd40nt.exe" [2005-03-18 57393]
"IndexSearch"="c:\program files\ScanSoft\PaperPort\IndexSearch.exe" [2005-03-18 40960]
"SetDefPrt"="c:\program files\Brother\Brmfl05a\BrStDvPt.exe" [2005-01-26 49152]
"ControlCenter2.0"="c:\program files\Brother\ControlCenter2\brctrcen.exe" [2005-05-17 933888]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-09-04 935288]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-09-15 81000]
"ISTray"="c:\program files\Spyware Doctor\pctsTray.exe" [2009-11-05 1107848]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-11-08 149280]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]
"BluetoothAuthenticationAgent"="bthprops.cpl" - c:\windows\system32\bthprops.cpl [2008-04-14 110592]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"UIHost"="c:\documents and settings\All Users\Application Data\TuneUp Software\TuneUp Utilities\WinStyler\tu_logonui.exe"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice]
@=""
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ioCentre
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VoipBuster
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Nero\\Nero 9\\Nero ShowTime\\ShowTime.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R0 DiagnosticScan;DiagnosticScan;c:\windows\system32\drivers\DiagnosticScan.SYS [3-11-2009 15:14 16384]
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [5-11-2009 16:50 114768]
R1 Start1Driver;Start1Driver;c:\windows\system32\drivers\Start1Driver.SYS [3-11-2009 15:14 5120]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [5-11-2009 16:50 20560]
R2 DUMeterSvc;DU Meter Service;c:\program files\DU Meter\DUMeterSvc.exe [1-10-2009 15:08 1391136]
R2 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [5-11-2009 20:22 337800]
R2 TuneUp.ProgramStatisticsSvc;TuneUp Program Statistics Service;c:\windows\system32\TUProgSt.exe [16-9-2009 20:17 604488]
R2 WDI;Windows Resident Anti-Virus;"c:\windows\System32\WinDefense32\wdi\svchost.exe" [4-11-2009 15:55 5634048]
S3 gHidPnp;USB Device Enhanced Function Driver;c:\windows\system32\Drivers\gHidPnp.Sys --> c:\windows\system32\Drivers\gHidPnp.Sys [?]
S3 gMouPS2;PS2 Scroll Mouse Device;c:\windows\system32\DRIVERS\gMouPS2.sys --> c:\windows\system32\DRIVERS\gMouPS2.sys [?]
S3 gMouUsb;USB Mouse Device Drv;c:\windows\system32\DRIVERS\gMouUsb.sys --> c:\windows\system32\DRIVERS\gMouUsb.sys [?]

--- Andere Services/Drivers In Geheugen ---

*NewlyCreated* - MBR
*Deregistered* - mbr
*Deregistered* - mchInjDrv
*Deregistered* - PROCEXP113

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
Inhoud van de 'Gedeelde Taken' map

2009-11-10 c:\windows\Tasks\1-klik Onderhoud.job
- c:\program files\TuneUp Utilities 2009\OneClickStarter.exe [2009-07-16 10:04]
.
.
------- Bijkomende Scan -------
.
uStart Page = hxxp://google.nl/
IE: E&xporteren naar Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
.
- - - - ORPHANS VERWIJDERD - - - -

WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
WebBrowser-{472734EA-242A-422B-ADF8-83D1E48CC825} - (no file)



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-11-10 16:49
Windows 5.1.2600 Service Pack 3 NTFS

detected NTDLL code modification:
ZwClose

scannen van verborgen processen ...

scannen van verborgen autostart items ...

scannen van verborgen bestanden ...

Scan succesvol afgerond
verborgen bestanden: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\DUMeterSvc]
"ImagePath"="c:\program files\DU Meter\DUMeterSvc.exe /startedbyscm:E1F6D4BE-40E33354-DUMeterService"
.
Voltooingstijd: 2009-11-10 16:52
ComboFix-quarantined-files.txt 2009-11-10 15:52

Pre-Run: 40.113.684.480 bytes beschikbaar
Post-Run: 40.590.073.856 bytes beschikbaar

WindowsXP-KB310994-SP2-Pro-BootDisk-NLD.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect /TUTag=UX2VK0 /Kernel=TUKernel.exe
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Professional (TuneUp Backup)" /noexecute=optin /fastdetect /TUTag=UX2VK0-BAK

- - End Of File - - A7E6728A68B4AF2D6666C0A079C16981
 
Ik ga nu zelfs denken dat het probleem opgelost is, als de melding over een uur niet terug is, ga ik de vraag als opgelost neerzetten,
Hartelijk dank voor je hulp en wijze raad.
 
Status
Niet open voor verdere reacties.
                    Steun ons                    

Nieuwste berichten

Terug
Bovenaan Onderaan